---
title: PowerDNS Security Advisories 2025-07 and 2025-08
description: "PowerDNS Security Advisories 2025-07: Internal logic flaw in cache management can lead to a denial of service in Recursor and 2025-08: Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor"
---

[PowerDNS Blog ](https://blog.powerdns.com)

# [PowerDNS Security Advisories 2025-07 and 2025-08](https://blog.powerdns.com/2025/12/08/powerdns-security-advisories-2025-07-and-2025-08)

 Written by [Otto Moerbeek](https://blog.powerdns.com/author/otto-moerbeek) | Dec 8, 2025 12:29:21 PM

Today we have released PowerDNS Recursor 5.1.9, 5.2.7 and 5.3.3.

These releases fix two PowerDNS Security Advisories:

- 2025-07: Internal logic flaw in cache management can lead to a denial of service in Recursor
- 2025-08: Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor.

#### PowerDNS Security Advisory 2025-07: Internal logic flaw in cache management can lead to a denial of service in Recursor

- **CVE**: CVE-2025-59029
- **Date**: 8th December 2025
- **Affects**: PowerDNS Recursor 5.3.0 and 5.3.1
- **Not affected**: PowerDNS Recursor 5.1.x, 5.2.x and 5.3.2
- **Severity**: Medium
- **Impact**: Denial of Service
- **Exploit**: This problem can be triggered by specific cache contents and a query with qtype ANY
- **Risk of system compromise**: None
- **Solution**: Upgrade to patched version or prevent requests with qtype ANY

CVSS Score: 5.6, see [https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1)

The remedy is: upgrade to a patched version or prevent requests with qtype ANY.

Version 5.3.2 of PowerDNS Recursor was never released publicly, upgrade to version 5.3.3.

#### PowerDNS Security Advisory 2025-08: Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

- **CVE**: CVE-2025-59030
- **Date**: 8th December 2025
- **Affects**: PowerDNS Recursor up to and including 5.3.2, 5.2.6 and 5.1.8
- **Not affected**: PowerDNS Recursor 5.3.3, 5.2.7 and 5.1.9
- **Severity**: High
- **Impact**: Denial of Service
- **Exploit**: This problem can be triggered by a notify arriving over TCP and allows clearing caches
- **Risk of system compromise**: None
- **Solution**: Upgrade to patched version or prevent incoming notifies over TCP

CVSS Score: 7.5, see [https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1)

The remedy is: upgrade to patched version or prevent incoming notifies over TCP.

Please refer to the changelogs  ([5.1.9](https://doc.powerdns.com/recursor/changelog/5.1.html#change-5.1.9), [5.2.7](https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.7) and [5.3.3](https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.3)) for additional details

Please send us all feedback and issues you might have via the [mailing list](https://mailman.powerdns.com/mailman/listinfo/pdns-users), or in case of a bug, via [GitHub](https://github.com/PowerDNS/pdns/issues/new/choose).

The tarballs ([5.1.9](https://downloads.powerdns.com/releases/pdns-recursor-5.1.9.tar.bz2), [5.2.7](https://downloads.powerdns.com/releases/pdns-recursor-5.2.7.tar.bz2), [5.3.3](https://downloads.powerdns.com/releases/pdns-recursor-5.3.3.tar.xz)) (with signature files [5.1.9](https://downloads.powerdns.com/releases/pdns-recursor-5.1.9.tar.bz2.sig), [5.2.7](https://downloads.powerdns.com/releases/pdns-recursor-5.2.7.tar.bz2.sig), [5.3.3](https://downloads.powerdns.com/releases/pdns-recursor-5.3.3.tar.xz.sig)) are available from our download [server](https://downloads.powerdns.com/releases/) and packages for several distributions are available from our [repository](https://repo.powerdns.com/).

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [policy](https://docs.powerdns.com/recursor/appendices/EOL.html) for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

 

[View full post](https://blog.powerdns.com/2025/12/08/powerdns-security-advisories-2025-07-and-2025-08)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Otto Moerbeek"
  },
  "dateModified" : "2026-01-14T09:03:59.025Z",
  "datePublished" : "2025-12-08T12:29:21Z",
  "headline" : "PowerDNS Security Advisories 2025-07 and 2025-08",
  "image" : {
    "@type" : "ImageObject",
    "height" : 540,
    "url" : "https://20334960.fs1.hubspotusercontent-na1.net/hubfs/20334960/PowerDNS_recursor_release_blog.png",
    "width" : 1008
  },
  "mainEntityOfPage" : "https://blog.powerdns.com/2025/12/08/powerdns-security-advisories-2025-07-and-2025-08",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "PowerDNS Blog"
  }
}
```